start	end	text
5500	9620	Hi everybody, we are here in front of the U.S. Congress to talk with you for a little
9620	14800	bit about the policy department at DEF CON. DEF CON is the annual hacker conference that
14800	19260	takes place each summer in Las Vegas, Nevada. This year it is going to be August 10th through
19260	24760	the 13th. DEF CON has been held since 1993, so this is the 31st DEF CON that is going
24760	29160	to be coming up. And as those years have gone by, cybersecurity policy has become a lot
29160	35300	more important. Both the enterprise as well as society and the policy makers have come
35300	39560	to seek out the expertise of the security community that is present at DEF CON. And
39560	44540	the security community has gotten more involved in policy making. And so this has evolved
44540	50260	to become a policy department, an official policy department at DEF CON. It was featured
50260	54160	there last year, it's going to be here again this year and going forward. The policy department
54160	59480	brings together security pros, hackers, as well as policy professionals and government
59480	63940	officials to mix because we all recognize that cybersecurity policy making is better
63940	69280	when you have community input. Now last year, the policy department at DEF CON held a lot
69280	73620	of bridge building events as well as mixers and fireside chats with White House staff
73620	78480	and senior government officials like Jen Easterly, the director of CISA, and Leonard Bailey,
78480	84140	the head of the computer crimes division at the Department of Justice, as well as a lot
84140	89680	of great policy content. Some of that content includes stuff like aviation policy, foreign
89680	95960	affairs, hacker law and how it affects security research, and a lot more, election security.
95960	100180	We can't reveal the policy content for DEF CON, the DEF CON policy department this year
100180	105020	just yet, but you can expect it to continue to engage with government officials, security
105020	110160	pros and hackers, and have deep dive conversations, hilarious conversations about some of the
110160	113780	most important cybersecurity policy issues that are being discussed right now. Those
113780	117940	can include the National Cyber Strategy in the United States, which was recently released
117940	121660	by the White House, and the implementation plan for that National Cyber Security Strategy
121660	125520	is going to be released soon. It touches on virtually every sector of the economy, including
125520	130540	security research. As part of that, critical infrastructure is going to be a hot topic.
130540	136740	The White House has directed regulatory agencies for sectors like electricity, water, food,
136740	141280	aviation and many others to look into ways to increase the resilience of the owners and
141280	146000	operators of those critical services. IoT cybersecurity is going to be another one.
146120	149680	There is going to be a labeling announcement that will be announced by the White House
149680	156780	here pretty soon that would create a security label that can be put onto consumer IoT devices.
156780	161420	And the criteria and the details of that have yet to be figured out. AI, of course, is another
161420	165340	extremely hot topic. The White House has announced that it's going to forge ahead with the National
165340	169600	AI Strategy that will include security. The White House has also announced a partnership
169600	176020	with the AI village at DEF CON to work with companies to open up some of the most important
176020	181320	generative AI models to independent security evaluation at DEF CON this year.
181680	187900	This is, of course, not just a U.S.-centric audience. The EU's Cyber Resilience Act,
187900	191540	as well as other pieces of legislation from the EU, are also going to get discussed.
191540	195680	The Cyber Resilience Act is an important one. That would require a lot of security features
195680	202040	to be built into the development and deployment of software sold in the EU. It'll have a GDPR-like
202040	207140	effect if and when it passes. It's already passed the EU Commission. It's now being discussed by
207140	213720	the other two parts of the EU Parliament. We can expect the passage of that in coming months.
213980	218940	And then lastly, but not least, supply chain and SBOM. Those requirements are flowing out
218940	223580	right now to federal contractors. SBOM is becoming more and more adopted into supply chain security
223580	228120	processes. We can expect continued discussion about that, as it is a major issue for anyone
228120	231520	that is making software, particularly if you're selling it to the U.S. government.
231560	235900	So, hope to see you at DEF CON this year. Wear something weird. Come and stop by the
235900	240060	DEF CON Policy Department. We'd really love to see you, August 10th through the 13th.
240060	244040	And in the meantime, follow us at DEF CON Policy on Twitter,
244040	248520	Mastodon, or LinkedIn, or visit us at defcon.org forward slash policy.
248520	250440	Thanks very much and hope to see you there.